Posted
by
CmdrTacoon Tuesday November 16, 2010 @03:24PM
from the i-bet-it's-nice-to-visit dept.

olsmeister writes "For 18 minutes this past April, 15% of the world's internet traffic was routed through servers in China. This includes traffic from both .gov and .mil US TLDs." The crazy thing is that this happened months ago, and nobody noticed. Hope you're encrypting your super-secret stuff.

They hijacked prefixes, not data. At least not directly. If you sent a packet during that time, it may have been routed to China. I doubt they stood up a big infrastructure to close TCP sessions with all of that incoming traffic and actually capture anything. Perhaps for a very targetted attack they could have, but then there'd be better ways than this to do it, I imagine.

I don't understand, why couldn't they just log all the data that went through ? Unencrypted passwords, http authentications, emails sent... It would have the potential to bring a lot of valuable informations. If I was the Chinese CIA, I would have only one goal : make it happen again.

They did not become a transit network where all of this information was just flowing through waiting to be logged.

They falsely announced that they owned certain prefixes and asked the Internet (web of trust) to forward packets with those destinations to their network.

In order for them to capture an email you sent during that time, they'd have to maintain a TCP connection with you and a fake email server that matches the destination IP address you were using. For a website, they'd likely capture the initial

as an IP engineer at a major backbone provider, I can safely comment on the hyperbole of this incident.

China Telcom -4134- would have to either send very/more specific routes and get max prefixes blown out, or send very general routes and loose to smaller routes.

yes, for a little while any "tier 1" player, or major government player, can convince another provider to send routes to an inappropriate AS, the game soon ends. anyone who isn't running at the very least a max prefix is a cluetard and needs their peering revoked anyway. From my 20%, 4134 is always a hair's breath away from getting a smackdown.

tldr; they can't really steal the whole internet, but we need to watch out for smaller route hyjacking.

UDP traffic would keep flowing to China so long as they advertised prefixes, but they're not really going to get any good intel out of that. Maybe some VoIP packets if they're lucky, but those are likely to end after about 20 seconds when the participants hang up because they can't hear each other (all packets are going to China, not to each other).

Anyone sending TCP traffic is going to stop as soon as they don't get an acknowledgment. Or never start if they can't complete a handshake. So not much is going

Big friggin deal. Any traffic captured from those TLD's would be external traffic. So now China know that Private Bloggins is jarhead59@gmail.com, and his girlfriend just dumped him. Quick, everybody panic!

Its the fastest way to insure that all your private data isn't private anymore. Why you would have private data on Facebook is beyond me, but playing the games (ie: allowing them access to your data) is the fastest way to insure that privacy is no longer a concern.

What's wrong with that? I don't see how computer-based communication is inherently less personal than letters or phone calls. Perhaps you're more comfortable with the latter methods, but that's a personal preference.

It is just that the USA has forgotten the Internet basics. It has also forgotten major past incidents like that case from 10 years back when one small ISP in Florida directed most of the Internet traffic through itself and fell over.

USA internet has very little redundancy. Most of the peering is private, in very few locations and the routes announced by ISPs to each other are not filtered based on declared ISP announcement policy. As the few remaining ISPs are so big the announcement lists have grown to a size where filtering them poses a technical difficulty. In addition to that because the ISPs are big they trust each others change control that routes for blocks which are "somebody's elses will not be announced". Bad Idea (TM). And that is why this was possible in the first place.

Compared to that in Europe most of the peering is public and nearly all ISPs heavily filter the route announcements coming from other peers. A Chinese ISP which would announce blocks it does not own would simply be ignored. It is of course possible for the ISP in question to add the policy to its official export list, post it to RIPE, get it propagated to other ISPs and then announce the routes, but that will take time and will have a big chance to be noticed. It will also be clear that there is "no mistake" there so the ISP in question will really get kicked off the internet for this one.

It's also possible that someone in China also doesn't understand Internet basics, and figured if he/she said "route everything here" it would stop propagating that at the border, because

The end of that line is almost certainly "because all his other peers have always been smart enough to filter incoming routes like 0/0 and now he's met his match, a guy that doesn't filter his incoming routes" Then Kaboom.

Speaking as a guy whom did customer facing BGP in the USA for a couple years, a couple years ago, and yes we did have incoming filters, and yes I saw some pretty sad stuff sent to us and filtered out. I always wondered what would happen to those guys when I left, or when they got account

At the risk of feeding the trolls,
"Dark fiber". VPN tunnels. Modems.
There are still a lot of ways data gets from point A to B without going through the normal routing rules, so near as I can tell, we already have more than one internet.

Depends, what is the normal average for traffic going through China? Among other things such as did China just happen to have the best routes for this anyways? This summary doesn't give the basic necessary information, oh wait this is slashdot I though I was in a different tab for a min.

Well, it depends. The protocol is made to be elastic, and therefore sensitive to network topography changes. Lines might become congested or go down, which means the shortest path might indeed be through a rather round-about course. Routing all this data to China would be quite an extreme example, though. Either a lot of failure would have to occur at the same time, or they would have to broadcast false numbers to give themselves a better routing metric.

There are plenty of reasons to use encryption but the Chinese government just isn't one of them for me. If I view something they don't like, what exactly are they going to do? I suppose they could block my access but it's not like I would get thrown in a Chinese prison.

I have a lot more to worry about from identity thieves, scams and heck, my own government.

I do know that. But all the same I have gotten IGS files from contractors in email. I have tried to inform people that email is as secure as a postcard but no one listens. We have even had people send credit card info to us in email.We have a policy to contact them when they do and suggest they cancel that card. I wonder how many do.

it is also true that china's privacy standards are orders of magnitude below the usa's standards, firmly entrenched in the toilet

so i don't understand a point of view that is more concerned with flawed standards, but much better standards, than they are with a country that is an actual, no-apologies firmly authoritarian "i tell you who your master is and what you can can cannot think" regime

You might wonder at his critical thinking skills, while I wonder at your listening skills. The idea that one should be more concerned about the privacy policies of one's own government than of the Chinese is a perfectly valid viewpoint. Perhaps he's more concerned about the policies of the US because
a) They actually impact him personally
b) They are something he can actually do something about

so i don't understand a point of view that is more concerned with flawed standards, but much better standards, than they are with a country that is an actual, no-apologies firmly authoritarian "i tell you who your master is and what you can can cannot think" regime

Because as US citizens we do have a say about what our country does, but there is practically nothing we can do to affect China's policies.

My country, right or wrong.If right to be kept right.If wrong to be set right.

The other replies have it right. I travel to the US on a semi regular basis. The Department of Molestation (sorry, TSA) and the increasingly paranoia driven policies of the US government impact me. China does not.

The US is also full of hypocritical politicians who get up on the world stage and talk about "freedom" this and that, while letting their own country slide into the toilet on that very thing. This nonsense has to be stood up. China doesn't spend as much time being holier-then-thou.

Seriously, what is wrong with you Americans? Can't you and your government live through life without manufacturing an enemy to hate? What is it in your national psyche that requires an opponent? Is it because you actually bought into your own "we're the Good Guys(TM)" propaganda that the only way to validate this absurd world view is to manufacture "bad guys". My theory is that you are so hung up on WWII, the last "good war" that you fought in, that you and your leaders are subconsciously trying to recreate it so that you can feel good about yourselves again. Hence, the Axis of evil, war on terror, and now a more traditional enemy, the Red Peril. Get over it.

This is why I only anonymize and encrypt nonsensitive data, like MySpace traffic, dating sites, etc. You want my shopping wish list on Amazon?! CRACK MY ENCRYPTION, NSA!!! But that stuff about overthrowing the government is wide open. Throws 'em way off.

"If China telecom intercepts that [encrypted message] and they are sitting on the middle of that, they can send you their public key with their public certificate and you will not know any better," he said. The holder of this certificate has the capability to decrypt encrypted communication links, whether it's web traffic, emails or instant messaging, Alperovitch said. "It is a flaw in the way the Internet operates," said Yoris Evers, director of worldwide public relations at McAfee.

What makes this really annoying is that a lot of.mil sites use self-signed certificates. When doing mil-2-mil browsing, you just get used to clicking whatever to get into the site. So, I can easily see how China could do a MITM without alarming any of the end users.

There was a funny thing at Brazil. Our government did go through that route, created a governemnt CA, ordered governamental sites to use it, but didn't do the small step of offering the certificates free of charge. That way, governamental entities must do a full selection process (a 6 month process, with luck) to get a certificate that is valid for a year. Guess what, most government sites at Brazil use a self signed cert.

Hint: that issuer ain't Verisign. I don't know whether that's the official DoD cert or if that's one created by that particular organization, but I do know that it doesn't ship with any popular browser by default

No, its not verisign. And of course they aren't self-signed, thats retarded. The US military has the largest PKI deployment in the world, they know a thing or two about certs. The DOD has their own root certificates which don't ship by default with commercial browser, since they aren't relevant f

It remains unclear whether the redirection was intentional, the report says, but it demonstrates that it is possible for malicious actors to seize control of the Internet and redirect traffic.
On April 8, according to Web security specialists, a small Chinese Internet service provider published a set of instructions under the Border Gateway Protocol, that directed Web traffic from about 37,000 networks to route itself via computer servers in China.
The list was republished by China Telecom and briefly propagated itself across the global Web, which works on a trust system, with each server updating its routing instructions based on data provided by others in the network.

What the hell is a 'trust system' anyway? Is that part of the Border Gateway Protocol? [cisco.com]
Maybe someone needs to take a closer look at this 'trust system.'

with BGP if I advertise my self as a route to a subnet others around me will try to send me that traffic IF they trust me.

now with a small company like mine.. my telco doesn't accept any routes other than my own subnets so instead i would just black hole my self.

now take a large telco or backbone provider.. say Level 3.. if they started advertising a route to my subnets then everyone who is closer to them then me (basically everyone) they will send L3 the traffic..

this type of attack/what ever you want to call it - only works if you are a big enough player for your neighbors to believe what you are advertising.

with my L3 example.. not every telco (or any really) would review that route change.. as for all they know i got a leased line from L3 or set up a peering agreement..

the cardinal sin of BGP is to advertise a route that isn't yours. but that is all it is.. and advertisement.

Wasn't IPSec supposed to protect against stuff like this, so even if someone was able to route internal traffic through a hostile source, all that could be done would be traffic analysis (finding which machines put more packets on the wire than others)?

Well, maybe not 100% but it's established that the bulk of US traffic is trunked off to closets in AT&T (and other) switch rooms. This is going to include any communications going to points outside the US and (more importantly) any traffic that happens to be routed through the US while going between two points outside the US.

1) Can China redirect traffic through its network by advertising that it has the lowest cost routing path? (Apparently, yes.) This is a wormhole attack, and is well documented in research literature.

2) Can China record or alter any traffic that passes through its network? If the data is sufficiently well encrypted, it can not read that data, although it can record the cyphertext. The fact that China can issue a certificate does not mean that it can read *your* data. It only means that encrypted data sent to Chinese servers can be read by the holder(s) of the encryption keys used by those servers.

If you are sending data over the net, and want to protect it, be sure that it is encrypted. If you don't care, be aware that anyone might be able to monitor it, even governments of other countries. If you don't trust the Chinese root CA to certify the identity of servers that you go to, don't accept their CA's certificate as an authority for that purpose.

If the data is sufficiently well encrypted, it can not read that data, although it can record the cyphertext. The fact that China can issue a certificate does not mean that it can read *your* data.

If they used a Man-In-The-Middle attack during the routing change, creating signed certificates using a top-level CA, they won't even need to decrypt anything. In addition, having the cypher text means that they can spend a few months or years using brute-force to decrypt it (or less, now that they have the fastest supercomputer in the world). Once they do, they'll have the keys for those sessions. Using that, they may even be able to derive the server's private key.

Breaking modern encryption algorithms using current techniques would take somewhere around the lifetime of the universe. The number of computations required to break a well designed algorithm increase exponentially with the key length. You should always use an algorithm and key length that can be expected to protect your data for longer than the data will remain valuable.

As I indicated in my explanation below, being able to create a certificate does not mean that they can trick you into trusting their sit

2) Can China record or alter any traffic that passes through its network? If the data is sufficiently well encrypted, it can not read that data, although it can record the cyphertext. The fact that China can issue a certificate does not mean that it can read *your* data. It only means that encrypted data sent to Chinese servers can be read by the holder(s) of the encryption keys used by those servers.

Notice the Chinese ones? The Chinese government can compel any of those root CAs to produce a certificate for any domain they choose. For example, let's say CNNIC [slashdot.org] creates rogue certs for Google.com.

1) You request a secure page "https://mail.google.com"2) MITM intercepts the request and makes their own connection to mail.google.com using the real cert.3) MITM uses the fake cert to encrypt it's connection to you, and pass you the mail.google.com data.4) Firefox validates the cert chain and gives you a big "look it's secure" bar, and you just got pwned.

The real problem is with the retarded cert system. Any CA can create certs for any domain without the domain's permission; If the CA is trusted your browser won't complain at all.

This is why it's important to view the certs that you are using (in Firefox, click or hover over the "secure" bar).Note: If you had a cookie that kept you signed in to gmail, its too late to check the cert after the MITM is logged into your account.

Please excuse the reply to myself, but I'd like to point out that I'm not trying to single out China here, the above statements apply to USA, UK, Canada, or government that a trusted Root CA company resides within.

Eg: The US Government could compel (and also gag-order) Thawte into creating fake certs for Google.com (or any other domain), and in Google's case, you wouldn't even find out you've been pwned by checking the cert...

Certificates aren't used to encrypt anything. The certificate contains a set of assertions about the subject of the certificate, signed by the certificate issuer. One of those assertions is typically the subject's public key. All the certificate is claiming is that a certain public key is associated with a certain identity, where that identity is claimed by the certification chain starting at some root (in this case, the Chinese CA). If you trust a certain root CA, then you also must trust any assertion

We can't afford the cost to administrate secrets. With all the current data gathering and monitoring techniques, the only people who can afford the cost of keeping actual secrets are professional sleuths or top level government and corporate people. They hold secrets on and from each other, but mostly from us. It seems the game is inverted now - by fighting to protect our right to illusory privacy, in practice we mosly protect their right to keep secrets from us.

Hah, just today my significant other responded to an email from someone lower down the ladder that read something like "if you don't want me to publish information X on the grounds that it was confidential, then why did you send it to me to be published?"

No, I wouldn't put all my money on the corporate world being able to keep secrets.

They were designed years ago, for an environment where it was actually somewhat sensible for everyone to trust everyone else. Major routing screwups like this, DNS cache poisoning exploits, the type of attack demonstrated by FireSheep, and even plain ol' spam are all possible largely because the underlying protocols are not secure.

You've completely missed my point. It should be possible to secure the Internet's routing protocols without infringing on anyone's freedoms. Furthermore, the lack of encryption on things like standard HTTP and e-mail traffic actually makes it easier for your electronic communications to be spied on.

The point isn't that it was routed through China per se; the point is that it is so easy to hijack the traffic of a large portion of the 'net. As has already been pointed out, anything sensitive should be encrypted anyway.

And how can that be achieved? At some point you have to trust your Browser, OS or hardware vendor / manufacturer.

There is no such thing as a trusted ISP or country.

Tell that to all the "Trusted Root CAs" installed in your browser. Who did you trust to put them there? The governments that those CAs reside in can coerce them into creating fake certs; This requires an implied trust in the country those CAs reside in.

IMO, "end to end" security is not used at all during a HTTPS connection, it's inheretly a 3 party process: You, Them, The CA. Encrypted data m

I attended a Unisys presentation in July (or so). They presented 256-bit encryption, which (by the sound of it) is out there already, used by the US Military (and suchlike) and allows the messages to go over the common internet.

As for my own stuff - they're welcome to see that I've ordered such-and-such a book, or that Cousin Thomas's measles are clearing up. Face it folks - most people's lives aren't that interesting. Except to themselves.